iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/net/mac80211
History
Lorenzo Bianconi 0184ede0ec wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration 
[ Upstream commit 3e8f7abcc3473bc9603323803aeaed4ffcc3a2ab ]

Fix possible out-of-bound access in ieee80211_get_rate_duration routine
as reported by the following UBSAN report:

UBSAN: array-index-out-of-bounds in net/mac80211/airtime.c:455:47
index 15 is out of range for type 'u16 [12]'
CPU: 2 PID: 217 Comm: kworker/u32:10 Not tainted 6.1.0-060100rc3-generic
Hardware name: Acer Aspire TC-281/Aspire TC-281, BIOS R01-A2 07/18/2017
Workqueue: mt76 mt76u_tx_status_data [mt76_usb]
Call Trace:
 <TASK>
 show_stack+0x4e/0x61
 dump_stack_lvl+0x4a/0x6f
 dump_stack+0x10/0x18
 ubsan_epilogue+0x9/0x43
 __ubsan_handle_out_of_bounds.cold+0x42/0x47
ieee80211_get_rate_duration.constprop.0+0x22f/0x2a0 [mac80211]
 ? ieee80211_tx_status_ext+0x32e/0x640 [mac80211]
 ieee80211_calc_rx_airtime+0xda/0x120 [mac80211]
 ieee80211_calc_tx_airtime+0xb4/0x100 [mac80211]
 mt76x02_send_tx_status+0x266/0x480 [mt76x02_lib]
 mt76x02_tx_status_data+0x52/0x80 [mt76x02_lib]
 mt76u_tx_status_data+0x67/0xd0 [mt76_usb]
 process_one_work+0x225/0x400
 worker_thread+0x50/0x3e0
 ? process_one_work+0x400/0x400
 kthread+0xe9/0x110
 ? kthread_complete_and_exit+0x20/0x20
 ret_from_fork+0x22/0x30

Fixes: db3e1c40cf2f ("mac80211: Import airtime calculation code from mt76")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-12-08 11:23:56 +01:00
..
aead_api.c
mac80211: Check crypto_aead_encrypt for errors
2021-04-10 13:36:08 +02:00
aead_api.h
…
aes_ccm.h
…
aes_cmac.c
mac80211: Update BIP to support Beacon frames
2020-02-24 10:36:03 +01:00
aes_cmac.h
…
aes_gcm.h
…
aes_gmac.c
mac80211: Check crypto_aead_encrypt for errors
2021-04-10 13:36:08 +02:00
aes_gmac.h
…
agg-rx.c
mac80211: fix lookup when adding AddBA extension element
2021-12-22 09:30:54 +01:00
agg-tx.c
mac80211: refuse aggregations sessions before authorized
2022-03-19 13:44:44 +01:00
airtime.c
wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration
2022-12-08 11:23:56 +01:00
cfg.c
wifi: mac80211: allow bw change during channel switch in mesh
2022-10-26 13:25:19 +02:00
chan.c
wifi: mac80211: fix use-after-free in chanctx code
2022-06-09 10:21:22 +02:00
debug.h
…
debugfs_key.c
mac80211: Support BIGTK configuration for Beacon protection
2020-02-24 10:35:57 +01:00
debugfs_key.h
mac80211: Support BIGTK configuration for Beacon protection
2020-02-24 10:35:57 +01:00
debugfs_netdev.c
cfg80211/mac80211: add connected to auth server to meshconf
2020-07-31 09:24:24 +02:00
debugfs_netdev.h
…
debugfs_sta.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2020-03-29 21:25:29 -07:00
debugfs_sta.h
…
debugfs.c
mac80211: fix incorrect strlen of .write in debugfs
2021-02-07 15:37:15 +01:00
debugfs.h
…
driver-ops.c
mac80211: fix station rate table updates on assoc
2021-02-10 09:29:16 +01:00
driver-ops.h
mac80211: mark TX-during-stop for TX in in_reconfig
2021-12-22 09:30:50 +01:00
ethtool.c
…
fils_aead.c
…
fils_aead.h
…
he.c
mac80211: use HE 6 GHz band capability and pass it to the driver
2020-05-31 11:27:03 +02:00
ht.c
mac80211: Use fallthrough pseudo-keyword
2020-07-31 09:24:23 +02:00
ibss.c
wifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected
2022-09-08 11:11:40 +02:00
ieee80211_i.h
wifi: mac80211: fix MBSSID parsing use-after-free
2022-10-17 17:26:07 +02:00
iface.c
mac80211: Fix monitor MTU limit so that A-MSDUs get through
2021-09-18 13:40:28 +02:00
Kconfig
ath9k: fix build error with LEDS_CLASS=m
2021-02-17 11:02:25 +01:00
key.c
mac80211: prevent mixed key and fragment cache attacks
2021-06-03 09:00:29 +02:00
key.h
mac80211: prevent mixed key and fragment cache attacks
2021-06-03 09:00:29 +02:00
led.c
…
led.h
…
main.c
wifi: mac80211: fix memory free error when registering wiphy fail
2022-12-02 17:39:57 +01:00
Makefile
mac80211: initialize last_rate for S1G STAs
2020-10-08 10:40:57 +02:00
mesh_hwmp.c
mac80211: fix potential overflow when multiplying to u32 integers
2021-03-04 11:37:32 +01:00
mesh_pathtbl.c
wifi: mac80211: Fix ack frame idr leak when mesh has no route
2022-12-02 17:39:57 +01:00
mesh_plink.c
mac80211: fix some more kernel-doc in mesh
2020-09-28 14:36:53 +02:00
mesh_ps.c
mac80211: mesh: fix potentially unaligned access
2021-10-06 15:55:52 +02:00
mesh_sync.c
…
mesh.c
mac80211: rename csa counters to countdown counters
2020-08-27 14:12:15 +02:00
mesh.h
mac80211: add HE 6 GHz Band Capability element
2020-05-31 11:26:39 +02:00
michael.c
…
michael.h
…
mlme.c
wifi: mac80211: fix MBSSID parsing use-after-free
2022-10-17 17:26:07 +02:00
ocb.c
…
offchannel.c
mac80211: Inform AP when returning operating channel
2020-09-28 13:18:53 +02:00
pm.c
…
rate.c
mac80211: fix station rate table updates on assoc
2021-02-10 09:29:16 +01:00
rate.h
mac80211: populate debugfs only after cfg80211 init
2020-04-24 11:30:13 +02:00
rc80211_minstrel_debugfs.c
mac80211: minstrel_ht: rename prob_ewma to prob_avg, use it for the new average
2019-10-11 10:31:45 +02:00
rc80211_minstrel_ht_debugfs.c
mac80211: minstrel_ht: rename prob_ewma to prob_avg, use it for the new average
2019-10-11 10:31:45 +02:00
rc80211_minstrel_ht.c
One batch of changes, containing:
2020-05-26 20:17:35 -07:00
rc80211_minstrel_ht.h
mac80211: minstrel_ht: rename prob_ewma to prob_avg, use it for the new average
2019-10-11 10:31:45 +02:00
rc80211_minstrel.c
mac80211: minstrel: fix tx status processing corner case
2020-11-12 11:25:09 +01:00
rc80211_minstrel.h
mac80211: minstrel: remove deferred sampling code
2020-11-12 11:24:43 +01:00
rx.c
wifi: mac80211: fix crash in beacon protection for P2P-device
2022-10-15 07:55:56 +02:00
s1g.c
mac80211: initialize last_rate for S1G STAs
2020-10-08 10:40:57 +02:00
scan.c
wifi: mac80211: fix MBSSID parsing use-after-free
2022-10-17 17:26:07 +02:00
spectmgmt.c
mac80211: 160MHz with extended NSS BW in CSA
2021-02-13 13:55:04 +01:00
sta_info.c
net: Use u64_stats_fetch_begin_irq() for stats fetch.
2022-09-08 11:11:40 +02:00
sta_info.h
mac80211: fix regression in SSN handling of addba tx
2021-12-22 09:30:50 +01:00
status.c
mac80211: fix memory leak on filtered powersave frames
2020-11-12 11:23:58 +01:00
tdls.c
mac80211: Use fallthrough pseudo-keyword
2020-07-31 09:24:23 +02:00
tkip.c
mac80211: Fix TKIP replay protection immediately after key setup
2020-01-15 09:52:12 +01:00
tkip.h
…
trace_msg.h
…
trace.c
…
trace.h
mac80211: notify the driver when a sta uses 4-address mode
2020-09-18 12:16:16 +02:00
tx.c
mac80211: limit injected vht mcs/nss in ieee80211_parse_tx_radiotap
2021-10-06 15:55:51 +02:00
util.c
wifi: mac80211: fix MBSSID parsing use-after-free
2022-10-17 17:26:07 +02:00
vht.c
mac80211: don't set set TDLS STA bandwidth wider than possible
2020-12-30 11:53:50 +01:00
wep.c
mac80211: make ieee80211_wep_init() return void
2020-02-07 12:40:34 +01:00
wep.h
mac80211: make ieee80211_wep_init() return void
2020-02-07 12:40:34 +01:00
wme.c
wifi: mac80211: fix queue selection for mesh/OCB interfaces
2022-07-21 21:20:00 +02:00
wme.h
…
wpa.c
mac80211: fix use-after-free in CCMP/GCMP RX
2021-10-06 15:55:48 +02:00
wpa.h
…